In order to maximize admissibility in court proceedings, evidence collected in an investigation must not be damaged, destroyed, or altered from the time that it is identified as evidence to the time that it is presented to the court. While paper evidence may be easily damaged or destroyed, there is not a great concern that the information and data found within a paper document can be altered. That is, the information found on the paper itself is not subject to change. The information and data on the paper today will be the same tomorrow, next week, next month, or next year, so long as the paper is properly preserved. This is not the case, however, with digitally-stored data.
Without the proper precautions and due care, digitally stored data is extremely easy to alter. Such an alteration can be unintentional and can be caused during an investigation. For example, time and date stamps indicating the last time a file was opened can be unintentionally altered, as well as a start-up or shut-down sequence designed by the owner to erase the computer's hard drive may be unintentionally activated, thereby destroying the usefulness of a confiscated computer.
As of today, for a computer investigator to forensically examine a computer, the computer first has to be processed and a forensic image should be created. The forensic image is then examined using a different computer. This methodology, however, does not provide the investigator with a “first person” perspective of the computer usage. That is, the full experience that a user of the original computer may have is not replicated through an external examination of the hard drive. In addition, the need to create the forensic image before examination to preclude the possibility of modifying of the original drive contents can add considerable time and expense to any investigation.
Given the foregoing, what is needed are systems, methods, and computer program products for facilitating the use of a computer system that can occur without altering the digital data on said computer system.